The vulnerability arises from incorrect permission checks in Octopus Server. As a result, any authenticated user can invoke a particular API endpoint to make server‑level changes, even though the system reports an error. This flaw enables unauthorized modification of configuration and settings that should be restricted to privileged users, potentially compromising the integrity of the deployment environment.

The affected product is Octopus Deploy Octopus Server. Specific product versions are not provided, so all deployed instances of Octopus Server are potentially vulnerable until a patch that restores proper access control is applied. The issue is limited to the server component and does not affect the client or agent.

The CVSS score of 6.0 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is purely authenticated, meaning the attacker must already have valid credentials. Once they obtain those credentials, they can manipulate the server using the susceptible API, leading to unintended configuration changes. The exploitation does not require remote code execution, but the impact on system integrity could be significant.